Courier IMAP server will not respond.

[tomrichmond]

Hi

I have just moved from a Fedora server using Dovecot, to Debian 6 with Courier.
I'm having a problem connecting to IMAP on port 993. The server does not respond. I've tried everything I can think of, and I still cannot connect, so i'm hoping somebody can shed some light on this for me.

The server was configuring using the Debian 6 ISPConfig3 Perfect Server setup.
There are no useful errors in mail.log, only entries like these below:

Apr  1 23:15:01 server1 imapd: Connection, ip=[::ffff:127.0.0.1]
Apr  1 23:15:01 server1 imapd: Disconnected, ip=[::ffff:127.0.0.1], time=0
Apr  1 23:15:01 server1 pop3d: Connection, ip=[::ffff:127.0.0.1]
Apr  1 23:15:01 server1 pop3d: Disconnected, ip=[::ffff:127.0.0.1]

netstat -an returns:

Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN     
tcp        0      0 192.168.1.10:53         0.0.0.0:*               LISTEN     
tcp        0      0 127.0.0.1:53            0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:21              0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN     
tcp        0      0 127.0.0.1:953           0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:25              0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:55290           0.0.0.0:*               LISTEN     
tcp        0      0 127.0.0.1:10024         0.0.0.0:*               LISTEN     
tcp        0      0 127.0.0.1:10025         0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:3306            0.0.0.0:*               LISTEN     
tcp        0      0 127.0.0.1:3306          127.0.0.1:42812         ESTABLISHED
tcp        0      0 127.0.0.1:3306          127.0.0.1:42806         ESTABLISHED
tcp        0      0 127.0.0.1:42806         127.0.0.1:3306          ESTABLISHED
tcp        0      0 127.0.0.1:42812         127.0.0.1:3306          ESTABLISHED
tcp        0      0 192.168.1.10:22         90.202.203.187:49365    ESTABLISHED
tcp6       0      0 :::143                  :::*                    LISTEN     
tcp6       0      0 :::8080                 :::*                    LISTEN     
tcp6       0      0 :::80                   :::*                    LISTEN     
tcp6       0      0 :::8081                 :::*                    LISTEN     
tcp6       0      0 :::53                   :::*                    LISTEN     
tcp6       0      0 :::21                   :::*                    LISTEN     
tcp6       0      0 :::22                   :::*                    LISTEN     
tcp6       0      0 ::1:953                 :::*                    LISTEN     
tcp6       0      0 :::443                  :::*                    LISTEN     
tcp6       0      0 :::993                  :::*                    LISTEN     
tcp6       0      0 :::995                  :::*                    LISTEN     
tcp6       0      0 :::110                  :::*                    LISTEN     
tcp6       0      0 192.168.1.10:143        90.202.203.187:52854    ESTABLISHED

netstat -tap | grep imap

tcp6       0      0 [::]:imap2              [::]:*                  LISTEN      12354/couriertcpd
tcp6       0      0 [::]:imaps              [::]:*                  LISTEN      21440/couriertcpd
tcp6       0      0 server1.tgrsvr.co:imap2 5acacbbb.bb.sky.c:52854 ESTABLISHED 24761/imapd

When I try:

openssl s_client -connect tgrsvr.co.uk:993

The server does not respond.

And finally, it doesn'e appear to be a firewall issue.

iptables -L

Chain INPUT (policy DROP)
target     prot opt source               destination         
fail2ban-courierimaps  tcp  --  anywhere             anywhere            multiport dports imaps 
fail2ban-ssh  tcp  --  anywhere             anywhere            multiport dports ssh 
fail2ban-pureftpd  tcp  --  anywhere             anywhere            multiport dports ftp 
fail2ban-courierpop3s  tcp  --  anywhere             anywhere            multiport dports pop3s 
fail2ban-courierpop3  tcp  --  anywhere             anywhere            multiport dports pop3 
fail2ban-courierimap  tcp  --  anywhere             anywhere            multiport dports imap2 
DROP       tcp  --  anywhere             loopback/8          
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     all  --  anywhere             anywhere            
DROP       all  --  BASE-ADDRESS.MCAST.NET/4  anywhere            
PUB_IN     all  --  anywhere             anywhere            
PUB_IN     all  --  anywhere             anywhere            
PUB_IN     all  --  anywhere             anywhere            
PUB_IN     all  --  anywhere             anywhere            
DROP       all  --  anywhere             anywhere            

Chain FORWARD (policy DROP)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
DROP       all  --  anywhere             anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
PUB_OUT    all  --  anywhere             anywhere            
PUB_OUT    all  --  anywhere             anywhere            
PUB_OUT    all  --  anywhere             anywhere            
PUB_OUT    all  --  anywhere             anywhere            

Chain INT_IN (0 references)
target     prot opt source               destination         
ACCEPT     icmp --  anywhere             anywhere            
DROP       all  --  anywhere             anywhere            

Chain INT_OUT (0 references)
target     prot opt source               destination         
ACCEPT     icmp --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            

Chain PAROLE (13 references)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            

Chain PUB_IN (4 references)
target     prot opt source               destination         
ACCEPT     icmp --  anywhere             anywhere            icmp destination-unreachable 
ACCEPT     icmp --  anywhere             anywhere            icmp echo-reply 
ACCEPT     icmp --  anywhere             anywhere            icmp time-exceeded 
ACCEPT     icmp --  anywhere             anywhere            icmp echo-request 
PAROLE     tcp  --  anywhere             anywhere            tcp dpt:ftp-data 
PAROLE     tcp  --  anywhere             anywhere            tcp dpt:ftp 
PAROLE     tcp  --  anywhere             anywhere            tcp dpt:ssh 
PAROLE     tcp  --  anywhere             anywhere            tcp dpt:smtp 
PAROLE     tcp  --  anywhere             anywhere            tcp dpt:domain 
PAROLE     tcp  --  anywhere             anywhere            tcp dpt:www 
PAROLE     tcp  --  anywhere             anywhere            tcp dpt:pop3 
PAROLE     tcp  --  anywhere             anywhere            tcp dpt:imap2 
PAROLE     tcp  --  anywhere             anywhere            tcp dpt:https 
PAROLE     tcp  --  anywhere             anywhere            tcp dpt:mysql 
PAROLE     tcp  --  anywhere             anywhere            tcp dpt:http-alt 
PAROLE     tcp  --  anywhere             anywhere            tcp dpt:tproxy 
PAROLE     tcp  --  anywhere             anywhere            tcp dpt:webmin 
ACCEPT     udp  --  anywhere             anywhere            udp dpt:domain 
ACCEPT     udp  --  anywhere             anywhere            udp dpt:mysql 
DROP       icmp --  anywhere             anywhere            
DROP       all  --  anywhere             anywhere            

Chain PUB_OUT (4 references)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            

Chain fail2ban-courierimap (1 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere            

Chain fail2ban-courierimaps (1 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere            

Chain fail2ban-courierpop3 (1 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere            

Chain fail2ban-courierpop3s (1 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere            

Chain fail2ban-pureftpd (1 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere            

Chain fail2ban-ssh (1 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere

Also, /etc/courier/imap-ssl is configured to port 993.
I have tried adding specific IPs (192.168.1.1,127.0.0.1) to the 'SSLADDRESS' field and restarting imap-ssl, but no joy.

Please help!

Thankyou.

[falko]

It seems you didn't open the ports 993 and 995 in ISPConfig's firewall.

[tomrichmond]

Wow. I'll just be off to kick myself then...

Thankyou!